Get the latest tech news

Backdoor in XZ Utils That Almost Happened

The recent cybersecurity catastrophe that wasn’t reveals an untenable situation, one being exploited by malicious actors. 

The ways the code evades detection in source form, how it lies dormant and undetectable until activated, and its immense power and flexibility give credence to the widely held assumption that a major nation-state is behind this. For years security engineers have been pushing something called a “ software bill of materials ”: an ingredients list of sorts so that when one of these packages is compromised, network owners at least know if they’re vulnerable. Like the power grid, communications network, and transportation systems, the software supply chain is critical infrastructure, part of national security, and vulnerable to foreign attack.

Get the Android app